diff --git a/DC-task-configure-syslog-server b/DC-task-configure-syslog-server new file mode 100644 index 000000000..3f3f31726 --- /dev/null +++ b/DC-task-configure-syslog-server @@ -0,0 +1,12 @@ +# This file originates from the project https://github.com/openSUSE/doc-kit +# This file can be edited downstream. + +MAIN="task-configure-syslog-server.xml" +ROOTID="task-configure-central-syslog-server" + +PROFCONDITION="suse-product" +#PROFCONDITION="suse-product;beta" +#PROFCONDITION="community-project" + +STYLEROOT="/usr/share/xml/docbook/stylesheet/suse2021-ns" +FALLBACK_STYLEROOT="/usr/share/xml/docbook/stylesheet/suse-ns" diff --git a/xml/task-configure-syslog-server.xml b/xml/task-configure-syslog-server.xml new file mode 100644 index 000000000..b453cbfaa --- /dev/null +++ b/xml/task-configure-syslog-server.xml @@ -0,0 +1,364 @@ + + + + + %entities; +]> + + + +
+ + + Forwarding log messages to a central syslog server + + + https://bugzilla.suse.com/enter_bug.cgi + Documentation + Product Name + cwickert@suse.com + + no + + + +
+ Environment + This document applies to the following products and product versions: + + + &sles; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &sles4sap; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &sleha; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &slehpc; 15 SP3, 15 SP2, 15 SP1, 15 GA + + + &sled; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + + &slert; 15 SP3, 15 SP2, 15 SP1, 15 GA, 12 SP5, 12 SP4, 12 SP3 + + +
+ +
+ Introduction + + System log data can be forwarded from individual systems to a central syslog + server on the network. This allows administrators to get an overview of + events on all hosts, and prevents attackers that succeed in taking over a + system from manipulating system logs to cover their tracks. + +
+ +
+ Requirements + + + + You have installed your product and your system is up and running. + + + + + The system is connected to the network. + + + + + + The rsyslog package is installed on all machines. + If not, run zypper in yast2-mail to install it. + + + + +
+ +
+ Setting up the central syslog server + + Setting up a central syslog server consists of two parts. First you configure + the central log server, then the clients for remote logging. + +
+ Setting up the central syslog server + + + Configure the central <systemitem>rsyslog</systemitem> server + + To set up a central syslog server, perform the following steps: + + + + Edit the configuration file + /etc/rsyslog.d/remote.conf. + + + + + Uncomment the following lines in the UDP Syslog Server + or TCP Syslog Server section of the configuration file. + Assign an IP address and port for rsyslogd. + + + TCP example: + + $ModLoad imtcp.so +$UDPServerAddress IP +$InputTCPServerRun PORT + + UDP example: + + $ModLoad imudp.so +$UDPServerAddress IP +$UDPServerRun PORT + + + + IP address of the interface for rsyslogd to listen on. If no address is + given, the daemon listens on all interfaces. + + + + + Port for rsyslogd to listen on. + Select a privileged port below 1024. The default is 514. + + + + + TCP versus UDP protocol + + Traditionally syslog uses the UDP protocol to transmit log messages over + the network. This involves less overhead, but lacks reliability. Log + messages can get lost under high load. + + + + + The TCP protocol is more reliable and should be preferred over UDP. + + + + <literal>UDPServerAddress</literal> with TCP + + The $UDPServerAddress configuration parameter in the + TCP example is no error. Despite its name it is used for both TCP and + UDP. + + + + + + Save the file. + + + + + Restart the rsyslog service: + +&prompt.sudo;systemctl restart rsyslog.service + + + Open the respective port in the firewall. For firewalld with TCP on port 514 run: + +&prompt.sudo;firewall-cmd --add-port 514/tcp --permanent +&prompt.sudo;firewall-cmd --reload + + + + You have now configured the central syslog server. Next, configure clients + for remote logging. + +
+
+ Set up the client machines + + Configure a <guimenu>rsyslog</guimenu> instance for remote logging + + To configure a system for remote logging on a central syslog server, + perform the following steps: + + + + Edit the configuration file + /etc/rsyslog.d/remote.conf. + + + + + Uncomment the appropriate line (TCP or UDP) and replace + remote-host with the address of the central syslog + server set up in . + + + TCP example: + + # Remote Logging using TCP for reliable delivery +# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional +*.* @@remote-host + + UDP example: + + # Remote Logging using UDP +# remote host is: name/ip:port, e.g. 192.168.0.1:514, port optional +*.* @remote-host + + + + Save the file. + + + + + Restart the rsyslog service: + + &prompt.sudo;systemctl restart rsyslog.service + + + + Verify the proper function of the syslog forwarding: + + &prompt.user;logger "hello world" + + The log message hello world should now appear on the + central syslog server. + + + + + You have now configured a system for remote logging to your central syslog + server. Repeat this procedure for all systems that should log remotely. + +
+
+ +
+ Summary + + You have configured one or more hosts for remote logging to your central + syslog server. This allows you to get a quick overview of events on your + network. + +
+ +
+ Troubleshooting + + In case the test log message does not appear on the syslog server, perform + the following steps to analyze the problem. + + + + Is rsyslog running? + + + If you made an error in the configuration of rsyslog, the daemon might refuse to start. + Check it is running with + systemctl status rsyslog.service. If the + service is down, the output includes additional information about the + reason. + + + Run this check on both the syslog server and the remote logging clients. + + + + + Is the firewall open? + + + Check if the firewall on the log server is open with + firewall-cmd --list-all. + + + + +
+ +
+ Next steps + + This basic setup does not include encryption and is only suitable for + trusted internal networks. TLS encryption is strongly recommended, but + requires a certificate infrastructure. + + + In this configuration, all messages from remote hosts will be treated the + same on the central syslog server. Consider filtering messages into separate + files by remote host or classify them by message category. + + + For more information about encryption, filtering, and other advanced topics, + consult the RSyslog documentation at + . + +
+ + +